CVE-2026-108751 in MoAI-ADK
Summary
by MITRE • 10/11/2026
MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so atomicWriteFile truncates and overwrites victim-writable files with MoAI template content.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in MoAI-ADK versions through 3.1.2 represents a critical security flaw rooted in improper link resolution within the moai init template deployer component. This issue specifically affects the mechanism used to stage and apply configuration templates during project initialization or deployment processes. The core of the problem lies in how the application handles temporary files, particularly those designated with the .moai-tmp extension. When a malicious repository is processed by this tool, it can exploit the underlying file system behavior regarding symbolic links to bypass intended directory boundaries. By committing a specially crafted symlink within the repository structure, an attacker can redirect the write operations of the deployment script away from the isolated staging area and toward arbitrary locations on the host filesystem that are writable by the user executing the command.
The technical execution of this attack relies on the interaction between the atomicWriteFile function and the operating system's handling of symbolic links. The vulnerability allows an attacker to commit a file such as .claude/settings.json.moai-tmp, which is configured not as a regular file but as a symlink pointing to a target path outside the project directory. When the moai init template deployer processes this entry, it attempts to write content into the specified staging path without adequately verifying whether that path resolves to a location within the expected sandboxed environment. Consequently, instead of writing to a temporary file in a secure temp directory or within the project root as intended, the system follows the symlink and overwrites the target file. This behavior effectively turns a standard template deployment operation into a vector for arbitrary file write attacks.
The operational impact of this vulnerability is significant, particularly in collaborative development environments where repositories are frequently cloned and initialized by multiple users. An attacker who controls or influences the content of a public repository can embed these malicious symlinks to target specific configuration files on the victim's machine. For instance, targeting .claude/settings.json allows for the manipulation of IDE settings, potentially leading to unauthorized code execution if those settings trigger scripts or extensions with elevated privileges. More broadly, overwriting any user-writable file can lead to data corruption, privilege escalation if system-level configurations are targeted by privileged users, or the installation of persistent backdoors disguised as legitimate configuration updates. This undermines the integrity and confidentiality guarantees expected from secure software deployment tools.
From a classification perspective, this vulnerability aligns with CWE-59 Improper Link Resolution Before File Access, also known as a path traversal via symbolic link race condition or improper symlink handling. It is further categorized under CWE-22 Path Traversal: '..' Sequence when the resulting write operation escapes the intended directory context. In terms of offensive security frameworks, this technique corresponds to ATT&CK T1564.003 Hidden Files and Directories, as it exploits hidden temporary files (.moai-tmp) to perform unauthorized modifications without immediate detection by standard file monitoring tools that might ignore staging artifacts. The attack vector is primarily remote via a malicious repository but requires local execution of the vulnerable tool, placing it in the Local Privilege Escalation or Persistence categories depending on the target and outcome.
Mitigation strategies must focus on hardening the file system interactions within the moai init template deployer. Developers should implement strict validation to ensure that all resolved paths for staging files remain strictly within a predefined safe directory structure, rejecting any symlinked targets that resolve outside this boundary. Utilizing operating-system-level features such as O_NOFOLLOW flags during file creation can prevent symbolic links from being followed inadvertently. Additionally, the atomicWriteFile function should be updated to canonicalize paths and verify their containment before performing write operations. For users currently affected by this vulnerability in MoAI-ADK versions through 3.1.2, immediate mitigation involves avoiding the initialization of untrusted repositories or manually inspecting repository contents for suspicious symlinked temporary files before running deployment commands. Upgrading to a patched version that enforces these path restrictions is the most effective long-term solution to eliminate this risk vector entirely.